A question on Hacker News this week cut to the heart of a problem the security community has been slow to address. A penetration tester asked what AI security risks are being overlooked beyond the obvious prompt injection attacks, and how the pentesting profession needs to change to find them.
The question resonated because the industry has spent most of its attention on prompt injection, the technique where adversaries manipulate an LLM into ignoring its instructions or revealing sensitive data. It is a real threat, but it is far from the only one. The broader attack surface of AI systems includes vulnerabilities that traditional penetration testing methods are not designed to catch.
The Attack Surface Is Not Just Prompts
Most security teams treat AI systems like black boxes. You send input in, you get output out, and you test the boundaries of what the model will do. This approach misses the infrastructure around the model itself. Training data poisoning, for example, involves corrupting the data a model learns from before deployment. No amount of prompt testing will reveal that the model's behavior has been compromised at the training stage.
Model extraction is another blind spot. An attacker can probe an API systematically to reconstruct a approximation of the underlying model, then use that copy to find vulnerabilities offline without triggering any monitoring on the production system. This is the equivalent of stealing a blueprint before you rob the building.
Data exfiltration through side channels is also underexplored. Language models leak information through response timing, token probability distributions, and even the specific phrasing they choose. An attacker who understands these channels can extract training data or system prompts without ever triggering a content filter.
Why Traditional Pentesting Falls Short
Standard penetration testing focuses on known vulnerability classes: SQL injection, cross-site scripting, broken authentication, and so on. These methods assume a relatively static target. You scan it, you fuzz it, you exploit what you find.
AI systems are probabilistic. The same input can produce different outputs depending on temperature settings, system prompt variations, and even the order of conversation history. This means a vulnerability might appear in one session and not in another. Pentesters need to think in distributions, not in binary pass-fail scenarios.
The infrastructure layer adds more complexity. LLM applications typically include retrieval augmented generation pipelines, vector databases, embedding services, orchestration frameworks, and external tool integrations. Each of these components has its own attack surface. A vulnerability in the vector database can leak sensitive documents even if the model itself is perfectly aligned.
What Pentesters Need to Learn
The question on Hacker News asked how pentesters will need to change. The short answer is that they need to understand machine learning well enough to test it meaningfully. This means learning how training data affects model behavior, how fine-tuning can introduce subtle biases, and how deployment configurations change the security posture of the same model.
Red teaming for AI systems also requires new tools. Fuzzing a language model is fundamentally different from fuzzing a web application. You need to understand tokenization, context windows, and the difference between what a model says it will do and what it actually does in edge cases.
The industry is moving in this direction, but slowly. OWASP has published guidance on LLM security risks. NIST has included AI systems in its cybersecurity framework updates. But the practitioners on the ground, the people who actually break into systems for a living, are still catching up.
The Risk of Complacency
The real danger is not that these vulnerabilities do not exist. It is that organizations assume their existing security practices cover them. A company that runs regular penetration tests on its web applications might deploy an AI-powered customer service bot without any security review at all, because the bot does not fit neatly into the categories their pentesters know how to test.
As AI systems become embedded in more products and workflows, the gap between what we know how to test and what we are actually deploying will keep growing. The Hacker News question was a good one. The answers are still being written.